Hi there,

The Oxford English dictionary defines cacophony "as a harsh discordant mixture of sounds" and describes it as "a cacophony of deafening alarm bells." I decided to take another look at the definition — given that this word has been ringing in my ears for the last couple of weeks while listening to the discussion about data privacy in India.

The decibel levels rose significantly with the news the Indian Union Cabinet approved the India Digital Personal Data Protection Bill on 5 July. And they rose even further when the DPDPB was officially listed in the roster of bills for consideration in the upcoming Monsoon session of the Indian Parliament, slated to begin 20 July.

Interestingly, this topic has made news not just in India but globally. My Google Alerts feed has swelled in volume over the last couple of weeks with the number of posts/news items/views on the bill that — when passed into law — would govern almost 20% of the world's population.

While I wait with bated breath for what finally unfolds, I collated some key "threads" from this cacophony around me. They fall into two groups: the key (and, in my opinion, "age-old") issues being discussed and debated once again and speculations on the final version of the bill.

So, what is being revisited and discussed?

Issues around consent as the primary legal ground for processing

The same issues have bubbled up again — how the focus on consent can give rise to consent fatigue, how the average user does not understand the impact and repercussions of giving/not giving consent, etc.

Why a data protection board vs. a data protection authority

The previous versions of the bill discussed setting up a data protection authority. Whereas the bill's latest version watered down the initiative to set up a data protection board. There is considerable apprehension about the Central Government exercising control over the board, questioning its potential autonomy.

The impact on the competitiveness of Indian businesses

Statistics from the EU's experience with the EU General Data Protection Regulation are being discussed, with several voices vociferously debating how the law will significantly increase the cost of compliance, leading to Indian businesses losing their competitiveness. The other related argument is about how innovation might be stifled. Again, no different from the arguments currently heard around the globe.

Implications of 'right to information'

As the Bill mentions personal data does not have a relationship with public interest will not be required to be shared under the existing powerful Right to Information Act, there have been several discussions about how the bill waters down the power of RTI.

Speculations about the upcoming bill

The media has reported some aspects of the upcoming bill based on "reliable sources," including: 

Cross border data flows

The earlier version of the bill talked about whitelisting a set of countries where personal data can be transferred. This has been changed to "blacklisting" certain countries/geographies where personal data cannot be transferred — which means personal data can likely freely flow to large sections of the globe.

Watered down children's data clauses 

The bill empowers the Central Government to lower the age of consent under certain conditions. The current age is 18 years old. Additionally, certain organizations may be exempt from certain obligations and clauses regarding children's data — which sounds ominous.

Add-ons related to AI

The earlier version of the bill had a specific clause that exempted the processing of personal data available in the public domain — which has been removed from the current version. This has led to speculation about regulating the scraping of personal data from the public domain, impacting AI-related initiatives.

'Exemptions galore'

Civil society folks have been strongly criticizing the bill for not being citizen-friendly, given the number of entities that have been or can be exempted from the purview of the bill. Startups and small businesses are rumored to be exempted from the bill. The Central Government also has powers to exempt certain government departments.

At the end of the day, we just have to wait and watch. All in all, exciting days are ahead.

Cheers,

Shivangi